CVE-2020-8936CWE-125

Arbitrary enclave memory overwrite vulnerability in ECall ecall_restore

Medium · published December 15, 2020

CVSS v3.1
5.3
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allows an attacker to make a host call to UntrustedCall. UntrustedCall failed to validate the buffer range within sgx_params and allowed the host to return a pointer that was an address within the enclave memory. This allowed an attacker to read memory values from within the enclave.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00135 · 2.7th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2020-12-15T14:55Z
EPSS history
Timeline
  • 15 DEC 14:55Z
    Arbitrary enclave memory overwrite vulnerability in ECall ecall_restore
    cvelistv5